Summary

OPENCLAW_OAUTH_CALLBACK_HOST changes the address the local callback HTTP server listens on, but REDIRECT_URI is hardcoded to http://localhost:53692/callback regardless of that env var.

Location

src/llm/utils/oauth/anthropic.ts:49

const CALLBACK_HOST = process.env.OPENCLAW_OAUTH_CALLBACK_HOST || "127.0.0.1";
// ...
const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;  // always localhost

Impact

Severity: Medium

1. Normal misuse — If OPENCLAW_OAUTH_CALLBACK_HOST is set to any non-localhost value, the callback server and the redirect_uri sent to claude.ai disagree, breaking the OAuth flow silently.
2. Malicious misuse — If an attacker controls OPENCLAW_OAUTH_CALLBACK_HOST (e.g. via a compromised .env file or environment injection), they can redirect the OAuth authorization code to an attacker-controlled host, hijacking the session token.

Reproduction

OPENCLAW_OAUTH_CALLBACK_HOST=attacker.example.com openclaw auth login anthropic
# redirect_uri sent to claude.ai: http://localhost:53692/callback
# callback server listens on:     attacker.example.com:53692
# => auth code never received locally; if DNS rebinding is possible, code goes to attacker

Remediation

• Option A (recommended): Remove OPENCLAW_OAUTH_CALLBACK_HOST entirely. The OAuth callback should always bind to 127.0.0.1 — there is no valid use case for a remote callback host in a local-first CLI tool.
• Option B: If the override is kept, derive REDIRECT_URI from CALLBACK_HOST and restrict accepted values to loopback addresses (127.0.0.1, ::1, localhost) with an explicit allowlist check.

Reported via automated codebase security review — github.com/openclaw/openclaw